TFTP Boot Image Pushed to Network Device

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects when a TFTP (Trivial File Transfer Protocol) boot image is potentially pushed to a network device. It specifically looks for UDP traffic on port 69 (TFTP default port) directed to the home network, containing the byte sequence "|00 02|" (which often indicates a TFTP write request or a specific TFTP opcode) and having a data size greater than 10000 bytes, suggesting a large file transfer like a boot image.